pi-roundtable-web 0.22.5 → 0.23.0

package/src/auth/password.ts

@@ -0,0 +1,250 @@
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+import type { ActorFacts, Logger } from "pi-roundtable";
+import { PluginError } from "pi-roundtable";
+import { type ConsolePresentation, message } from "../features.ts";
+import { MIN_PASSWORD_LENGTH } from "../options.ts";
+import { readLimited } from "../request-body.ts";
+import { LOGIN_CSP, loginPage } from "./login-page.ts";
+
+/** The session cookie's name. */
+const SESSION_COOKIE = "rt_session";
+/** How many failed logins in the window lock the login page. */
+const MAX_FAILURES = 10;
+const WINDOW_MS = 15 * 60 * 1000;
+/** A login form is a password; anything bigger is not one. */
+const MAX_BODY_BYTES = 4096;
+
+export interface PasswordOptions {
+	/** The secret, already read from the environment and checked. */
+	password: string;
+	/** The session key from the data directory. */
+	key: Buffer;
+	/** Who a session speaks for: the plugin identity's subject and name. */
+	actor: ActorFacts;
+	mount: string;
+	origin: string;
+	sessionDays: number;
+	title: string;
+	presentation: ConsolePresentation | undefined;
+	logger: Logger;
+	/** How long each failed login waits before answering; default 1000. */
+	loginDelayMs: number;
+	now: () => number;
+}
+
+/** A valid session: when it ends. */
+export type SessionCheck =
+	| { valid: true; expiresAt: Date }
+	| { valid: false; reason: string };
+
+const sha256 = (value: string | Buffer) =>
+	createHash("sha256").update(value).digest();
+
+const sign = (key: Buffer, payload: string) =>
+	createHmac("sha256", key).update(payload).digest();
+
+/** Whether two buffers are the same, in time that does not depend on where they differ. */
+const same = (a: Buffer, b: Buffer) =>
+	a.length === b.length && timingSafeEqual(a, b);
+
+/** Whether a cookie part is the one base64url spelling of its bytes; unused trailing bits would let several spellings pass. */
+const canonical = (part: string) =>
+	Buffer.from(part, "base64url").toString("base64url") === part;
+
+/** Checks the secret's length and returns it; the message never holds it. */
+export function checkPassword(
+	env: Readonly<Record<string, string | undefined>>,
+	name: string,
+): string {
+	const value = env[name];
+	if (value === undefined || value === "")
+		throw new PluginError(
+			`pi-roundtable-web: auth password reads the password from the environment variable ${name}, which is not set. Set it to a secret of at least ${MIN_PASSWORD_LENGTH} characters`,
+		);
+	if (Array.from(value).length < MIN_PASSWORD_LENGTH)
+		throw new PluginError(
+			`pi-roundtable-web: the password in ${name} is shorter than ${MIN_PASSWORD_LENGTH} characters; use at least ${MIN_PASSWORD_LENGTH}`,
+		);
+	return value;
+}
+
+const cookieValue = (
+	header: string | null,
+	name: string,
+): string | undefined => {
+	for (const part of (header ?? "").split(";")) {
+		const at = part.indexOf("=");
+		if (at > 0 && part.slice(0, at).trim() === name)
+			return part.slice(at + 1).trim();
+	}
+	return undefined;
+};
+
+/** The body of a login form, or undefined when it is larger than a password can be. */
+async function readForm(
+	request: Request,
+): Promise<URLSearchParams | undefined> {
+	const raw = await readLimited(request, MAX_BODY_BYTES);
+	return raw && new URLSearchParams(raw.toString("utf8"));
+}
+
+/**
+ * The password credential: a login page, a signed session cookie, a global rate limit.
+ *
+ * The cookie is `b64url({p, e, v: 1}).b64url(HMAC-SHA256)`. Its key is the HMAC of the session key
+ * over the password's digest, so a new password logs everyone out, and the session key alone
+ * (a file in the data directory) signs nothing a host with another password would accept.
+ */
+export class PasswordCredential {
+	readonly #options: PasswordOptions;
+	readonly #secret: Buffer;
+	readonly #signing: Buffer;
+	readonly #failures: number[] = [];
+	readonly #secure: boolean;
+	readonly #path: string;
+
+	constructor(options: PasswordOptions) {
+		this.#options = options;
+		this.#secret = sha256(options.password);
+		this.#signing = sign(options.key, this.#secret.toString("base64url"));
+		this.#secure = options.origin.startsWith("https:");
+		this.#path = `${options.mount}/`;
+	}
+
+	/** Whether the request carries a session this host made and that has not ended. */
+	check(request: Request): SessionCheck {
+		const value = cookieValue(request.headers.get("cookie"), SESSION_COOKIE);
+		if (!value) return { valid: false, reason: "no session" };
+		const parts = value.split(".");
+		const [payload, signature] = parts;
+		if (
+			parts.length !== 2 ||
+			!payload ||
+			!signature ||
+			!canonical(payload) ||
+			!canonical(signature)
+		)
+			return { valid: false, reason: "malformed session" };
+		if (
+			!same(sign(this.#signing, payload), Buffer.from(signature, "base64url"))
+		)
+			return { valid: false, reason: "invalid session" };
+		let claims: { p?: unknown; e?: unknown; v?: unknown };
+		try {
+			claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+		} catch {
+			return { valid: false, reason: "invalid session" };
+		}
+		if (
+			claims.v !== 1 ||
+			claims.p !== this.#options.actor.subject ||
+			typeof claims.e !== "number"
+		)
+			return { valid: false, reason: "invalid session" };
+		if (claims.e * 1000 <= this.#options.now())
+			return { valid: false, reason: "session ended" };
+		return { valid: true, expiresAt: new Date(claims.e * 1000) };
+	}
+
+	/**
+	 * The routes that need no session below the mount: the login page, `auth/login` and
+	 * `auth/logout`. Undefined for any other path.
+	 */
+	async open(request: Request, rest: string): Promise<Response | undefined> {
+		if (rest === "login")
+			return request.method === "GET" || request.method === "HEAD"
+				? this.#page(200)
+				: new Response("Method not allowed", { status: 405 });
+		if (rest !== "auth/login" && rest !== "auth/logout") return undefined;
+		if (request.method !== "POST")
+			return new Response("Method not allowed", { status: 405 });
+		if (request.headers.get("origin") !== this.#options.origin)
+			return new Response("Forbidden", {
+				status: 403,
+				headers: { "cache-control": "no-store" },
+			});
+		return rest === "auth/login" ? this.#login(request) : this.#logout();
+	}
+
+	#page(
+		status: number,
+		note?: string,
+		headers: Record<string, string> = {},
+	): Response {
+		const { mount, title, presentation } = this.#options;
+		return new Response(loginPage(mount, title, presentation, note), {
+			status,
+			headers: {
+				"content-type": "text/html;charset=utf-8",
+				"cache-control": "no-store",
+				"content-security-policy": LOGIN_CSP,
+				...headers,
+			},
+		});
+	}
+
+	#redirect(to: string, cookie: string): Response {
+		return new Response(null, {
+			status: 303,
+			headers: {
+				location: to,
+				"set-cookie": cookie,
+				"cache-control": "no-store",
+			},
+		});
+	}
+
+	#cookie(value: string, maxAge: number): string {
+		return `${SESSION_COOKIE}=${value}; Path=${this.#path}; Max-Age=${maxAge}; HttpOnly; SameSite=Strict${this.#secure ? "; Secure" : ""}`;
+	}
+
+	/** Seconds until the login page opens again, or 0 when it is open. */
+	#lockedFor(): number {
+		const cutoff = this.#options.now() - WINDOW_MS;
+		while (this.#failures.length > 0 && (this.#failures[0] ?? 0) <= cutoff)
+			this.#failures.shift();
+		if (this.#failures.length < MAX_FAILURES) return 0;
+		return Math.max(
+			1,
+			Math.ceil(
+				((this.#failures[0] ?? 0) + WINDOW_MS - this.#options.now()) / 1000,
+			),
+		);
+	}
+
+	async #login(request: Request): Promise<Response> {
+		const { logger, presentation } = this.#options;
+		const form = await readForm(request);
+		if (!form) return new Response("Payload too large", { status: 413 });
+		const retry = this.#lockedFor();
+		if (retry > 0) {
+			logger.warn({ retryAfter: retry }, "web-console: login is locked");
+			return this.#page(
+				429,
+				message(presentation, "Too many failed attempts. Try again later."),
+				{ "retry-after": String(retry) },
+			);
+		}
+		const given = form.get("password") ?? "";
+		if (!same(sha256(given), this.#secret)) {
+			// Counted before the wait, so a burst of attempts at once cannot get past the limit.
+			this.#failures.push(this.#options.now());
+			logger.warn("web-console: a login failed");
+			if (this.#options.loginDelayMs > 0)
+				await Bun.sleep(this.#options.loginDelayMs);
+			return this.#page(401, message(presentation, "Wrong password."));
+		}
+		const { sessionDays, actor } = this.#options;
+		const expires =
+			Math.floor(this.#options.now() / 1000) + sessionDays * 86400;
+		const payload = Buffer.from(
+			JSON.stringify({ p: actor.subject, e: expires, v: 1 }),
+		).toString("base64url");
+		const value = `${payload}.${sign(this.#signing, payload).toString("base64url")}`;
+		return this.#redirect(this.#path, this.#cookie(value, sessionDays * 86400));
+	}
+
+	#logout(): Response {
+		return this.#redirect(`${this.#options.mount}/login`, this.#cookie("", 0));
+	}
+}

package/src/auth/session-key.ts

@@ -0,0 +1,65 @@
+import { randomBytes } from "node:crypto";
+import {
+	chmodSync,
+	linkSync,
+	mkdirSync,
+	readFileSync,
+	statSync,
+	unlinkSync,
+	writeFileSync,
+} from "node:fs";
+import { join } from "node:path";
+import type { Logger } from "pi-roundtable";
+import { PluginError } from "pi-roundtable";
+
+const KEY_BYTES = 32;
+
+const readKey = (file: string): Buffer => {
+	const key = readFileSync(file);
+	if (key.length !== KEY_BYTES)
+		throw new PluginError(
+			`pi-roundtable-web: ${file} holds ${key.length} bytes, not ${KEY_BYTES}. It is the console's session key: delete it to sign everyone out and make a new one, or restore it`,
+		);
+	return key;
+};
+
+/**
+ * The console's session key, `<dataDir>/web/session.key`: 32 random bytes, readable by its owner
+ * only, made at the first start and kept so a restart does not sign anyone out. A file of the
+ * wrong size stops startup instead of being used, since a short key would be a weak one.
+ */
+export function loadSessionKey(dataDir: string, logger: Logger): Buffer {
+	const dir = join(dataDir, "web");
+	const file = join(dir, "session.key");
+	mkdirSync(dir, { recursive: true, mode: 0o700 });
+	let key: Buffer;
+	try {
+		key = readKey(file);
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+		// Written whole under a temporary name, then linked into place: a second start never
+		// reads a half-written key, and the first link wins.
+		const temp = join(
+			dir,
+			`.session.key.${process.pid}.${randomBytes(4).toString("hex")}`,
+		);
+		writeFileSync(temp, randomBytes(KEY_BYTES), { flag: "wx", mode: 0o600 });
+		try {
+			linkSync(temp, file);
+		} catch (linkError) {
+			if ((linkError as NodeJS.ErrnoException).code !== "EEXIST")
+				throw linkError;
+		} finally {
+			unlinkSync(temp);
+		}
+		key = readKey(file);
+	}
+	if (statSync(file).mode & 0o077) {
+		chmodSync(file, 0o600);
+		logger.warn(
+			{ file },
+			"web-console: the session key was readable by others; its mode is now 0600",
+		);
+	}
+	return key;
+}

package/src/cleanup-api.ts

@@ -28,7 +28,7 @@ export async function cleanupConversation(
 		Boolean(team?.owns(key)) || Boolean(features?.party?.contains(key));
 	const group =
 		(await team?.status())?.groups.some(
-			(g) => `discord:${g.channelId}` === key,
+			(g) => g.channelId !== undefined && `discord:${g.channelId}` === key,
 		) ?? false;
 	const stored =
 		!owned &&

package/src/cloudflare-access.ts

@@ -39,7 +39,7 @@ export function cloudflareAccessIdentity(
  * for this application, naming that email and a user. The token is checked on every request, so
  * the console stays closed to a client that reaches it without passing through Access. It reports
  * the user as an OpenID identity of the team's issuer, their `sub` as the subject and their email
- * as the name.
+ * as the name, and the token's expiry as when the admission lapses.
  */
 export function cloudflareAccess(
 	options: CloudflareAccessOptions,
@@ -66,6 +66,7 @@ export function cloudflareAccess(
 		if (!token) return refuse("no Access token");
 		let email: string;
 		let subject: string;
+		let expiresAt: Date | undefined;
 		try {
 			const { payload } = await jwtVerify(token, keys, { issuer, audience });
 			if (
@@ -77,9 +78,11 @@ export function cloudflareAccess(
 				return refuse("Access token names no user");
 			email = payload.email.toLowerCase();
 			subject = payload.sub;
+			if (typeof payload.exp === "number")
+				expiresAt = new Date(payload.exp * 1000);
 		} catch {
 			return refuse("invalid Access token");
 		}
-		return admitAs({ provider, subject, name: email });
+		return admitAs({ provider, subject, name: email }, expiresAt);
 	};
 }

package/src/console-api.ts

@@ -80,11 +80,15 @@ export interface ConsolePorts {
 	features?: ConsoleFeatures;
 	presentation?: ConsolePresentation;
 	mountPath?: string;
+	look?: "modern" | "camelot";
+	/** Present when the owner app is served: its rooms' key prefix, for the page. */
+	app?: { surface: string; protocol: string };
 }
 
 import { cleanupConversation } from "./cleanup-api.ts";
 import { connectorsView } from "./connectors-api.ts";
 import { ConsoleHttpError as HttpError, json } from "./http.ts";
+import { readLimited } from "./request-body.ts";
 import { skillCatalog, skillDetail } from "./skills-api.ts";
 
 /** Memory refusals as the Notes pane shows them. */
@@ -184,7 +188,7 @@ export class ConsoleApi {
 				})),
 				groups: view.groups.map((group) => ({
 					...group,
-					key: `discord:${group.channelId}`,
+					key: group.channelId ? `discord:${group.channelId}` : "",
 				})),
 				workspaces: (view.workspaces ?? []).map((c) => ({
 					...c,
@@ -240,7 +244,9 @@ export class ConsoleApi {
 			...(presentation?.messages ? { messages: presentation.messages } : {}),
 			...(features?.cleanup ? { cleanup: true } : {}),
 			...(connectorAdminUrl ? { connectorAdminUrl } : {}),
+			look: this.#ports.look ?? "modern",
 			...(this.#ports.mountPath ? { mountPath: this.#ports.mountPath } : {}),
+			...(this.#ports.app ? { app: this.#ports.app } : {}),
 		};
 	}
 
@@ -283,7 +289,8 @@ export class ConsoleApi {
 			groups: status.groups.map((group) => ({
 				name: group.name,
 				displayName: group.displayName,
-				channelId: group.channelId,
+				// A group of a team without Discord has no channel; the pane then links none.
+				...(group.channelId ? { channelId: group.channelId } : {}),
 				members: group.members,
 				host: group.host,
 				busy: group.busy,
@@ -513,21 +520,12 @@ export class ConsoleApi {
 	}
 }
 
-/** The JSON body, read in chunks so a body past the limit is refused without being held whole. */
+/** The JSON body; undefined when it is not JSON. */
 async function readBody(request: Request): Promise<unknown> {
-	const tooLarge = () => new HttpError(413, "The request is too large.");
-	if (Number(request.headers.get("content-length") ?? 0) > MAX_BODY_BYTES)
-		throw tooLarge();
-	const chunks: Uint8Array[] = [];
-	let size = 0;
-	if (request.body)
-		for await (const chunk of request.body) {
-			size += chunk.byteLength;
-			if (size > MAX_BODY_BYTES) throw tooLarge();
-			chunks.push(chunk);
-		}
+	const raw = await readLimited(request, MAX_BODY_BYTES);
+	if (!raw) throw new HttpError(413, "The request is too large.");
 	try {
-		return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+		return JSON.parse(raw.toString("utf8"));
 	} catch {
 		return undefined;
 	}

package/src/console-server.ts

@@ -1,10 +1,15 @@
-import type { ActorFacts, HttpRoute, Logger } from "pi-roundtable";
+import type { HttpRoute, Logger, WebSocketRoute } from "pi-roundtable";
+import type { AppSocket } from "./app/sockets.ts";
 import type { AssetBundle } from "./assets.ts";
+import type {
+	Authenticated,
+	Authenticator,
+	Unauthenticated,
+} from "./auth/authenticator.ts";
 import type { ConsoleApi } from "./console-api.ts";
 import type { ConsolePresentation } from "./features.ts";
 import { presentPage } from "./page-presentation.ts";
-import type { RequestVerifier } from "./verifier.ts";
-import type { Identified, Visitor } from "./visitors.ts";
+import { servePwa } from "./pwa.ts";
 
 const encoder = new TextEncoder();
 /** Changes closer together than this reach the page as one event. */
@@ -33,12 +38,21 @@ export interface ConsoleServerOptions {
 	/** The path the console is served under, without a trailing slash: `/console`. */
 	mount: string;
 	assets: AssetBundle;
-	verifier: RequestVerifier;
-	/** Who a request the verifier admitted comes from, by the actor it reported; only an owner is a visitor. */
-	identify(actor: ActorFacts | undefined): Promise<Identified>;
-	/** The console's own origin; requests that change data must come from it. */
-	origin: string;
+	/** Checks every request under the mount, and answers the few paths that need no session. */
+	authenticator: Authenticator;
 	api: Pick<ConsoleApi, "handle">;
+	/**
+	 * The owner app, when the `rooms` pane is served: it answers its own paths below the mount
+	 * before the console's API does, and its WebSocket takes the upgrades of the console's route.
+	 */
+	app?: {
+		handle(
+			request: Request,
+			rest: string,
+			admission: Authenticated,
+		): Promise<Response | undefined>;
+		websocket: WebSocketRoute<AppSocket>;
+	};
 	/** Registers the listener with every source whose change the console shows. */
 	subscribe(listener: () => void): void;
 	logger: Logger;
@@ -47,12 +61,18 @@ export interface ConsoleServerOptions {
 	/** Serve client page paths as the same authenticated document. */
 	pathRouting?: boolean;
 	presentation?: ConsolePresentation;
+	/** The manifest's name; default `Roundtable`. */
+	title?: string;
+	/** Where the install icons come from; default the ones this package ships. */
+	iconsDir?: string;
+	look?: "modern" | "camelot";
 }
 
 /**
  * The console on the host's listener: `<mount>` redirects to `<mount>/`, and everything under
- * it needs the verifier to vouch for the person and that person to be an owner. A request that
- * changes data must also carry the console's own `Origin`.
+ * it needs the authenticator to admit the request as an owner's, apart from what it answers
+ * openly, such as a login page. A request that changes data must also carry the console's own
+ * `Origin`.
  */
 export class ConsoleServer {
 	readonly #options: ConsoleServerOptions;
@@ -67,7 +87,11 @@ export class ConsoleServer {
 		options.subscribe(() => this.#changed());
 	}
 
-	routes(listener: string): HttpRoute[] {
+	/**
+	 * The routes on `listener`. `maxRequestBodyBytes` is the largest body the console takes, for
+	 * the owner app's uploads; without it the listener's default stands.
+	 */
+	routes(listener: string, maxRequestBodyBytes?: number): HttpRoute[] {
 		const handle = (request: Request) => this.handle(request);
 		return [
 			{
@@ -81,6 +105,10 @@ export class ConsoleServer {
 				listener,
 				path: { prefix: this.#base },
 				handle,
+				...(maxRequestBodyBytes === undefined ? {} : { maxRequestBodyBytes }),
+				...(this.#options.app
+					? { websocket: this.#options.app.websocket }
+					: {}),
 			},
 		];
 	}
@@ -116,25 +144,20 @@ export class ConsoleServer {
 		const path = new URL(request.url).pathname;
 		if (path !== this.#options.mount && !path.startsWith(this.#base))
 			return new Response("Not found", { status: 404 });
-		const admission = await this.#admission(request);
-		if ("refusal" in admission) {
-			this.#options.logger.warn(
-				{ refusal: admission.refusal },
-				"console request refused",
-			);
-			return new Response("Forbidden", {
-				status: 403,
-				headers: { "cache-control": "no-store" },
-			});
-		}
+		const rest = path.slice(this.#base.length);
+		const open = await this.#options.authenticator.open?.(request, rest);
+		if (open) return open;
+		const admission = await this.#options.authenticator.authenticate(request);
+		if ("refusal" in admission) return this.#refused(request, rest, admission);
 		if (path === this.#options.mount)
 			return new Response(null, {
 				status: 302,
 				headers: { location: this.#base },
 			});
-		const rest = path.slice(this.#base.length);
 		if (rest === "api/events" && request.method === "GET")
 			return this.#events();
+		const owned = await this.#options.app?.handle(request, rest, admission);
+		if (owned) return owned;
 		if (rest.startsWith("api/"))
 			return this.#options.api.handle(
 				request,
@@ -143,8 +166,13 @@ export class ConsoleServer {
 			);
 		if (!READ_METHODS.has(request.method))
 			return new Response("Method not allowed", { status: 405 });
+		const installable = servePwa(rest, {
+			...this.#options,
+			title: this.#options.title ?? "Roundtable",
+		});
+		if (installable) return installable;
 		const asset = this.#options.assets.get(rest);
-		if (asset && rest !== "index.html")
+		if (asset && rest !== "index.html" && rest !== "sw.js")
 			return new Response(new Uint8Array(asset.body), {
 				headers: {
 					"content-type": asset.type,
@@ -159,6 +187,7 @@ export class ConsoleServer {
 						page.body,
 						this.#options.pathRouting ? this.#options.mount : undefined,
 						this.#options.presentation,
+						this.#options.look,
 					),
 					{
 						headers: {
@@ -177,33 +206,32 @@ export class ConsoleServer {
 		return new Response("Not found", { status: 404 });
 	}
 
-	/** The owner the request comes from when it may pass, otherwise why not; never throws. */
-	async #admission(
-		request: Request,
-	): Promise<{ visitor: Visitor } | { refusal: string }> {
-		let actor: ActorFacts | undefined;
-		try {
-			const verdict = await this.#options.verifier(request);
-			if (!verdict.admitted) return { refusal: String(verdict.reason) };
-			actor = verdict.actor;
-		} catch {
-			// A verifier that fails admits no one.
-			return { refusal: "verifier failed" };
-		}
-		let identified: Identified;
-		try {
-			identified = await this.#options.identify(actor);
-		} catch {
-			// Nor does a lookup of who they are that fails.
-			return { refusal: "identity failed" };
-		}
-		if ("refusal" in identified) return { refusal: String(identified.refusal) };
+	/**
+	 * The answer to a request the authenticator refused: a page navigation that signing in would
+	 * fix goes to the login page, everything else gets the status and a fixed body.
+	 */
+	#refused(request: Request, rest: string, refusal: Unauthenticated): Response {
 		if (
-			!READ_METHODS.has(request.method) &&
-			request.headers.get("origin") !== this.#options.origin
+			refusal.login &&
+			READ_METHODS.has(request.method) &&
+			!rest.startsWith("api/")
 		)
-			return { refusal: "foreign origin" };
-		return identified;
+			return new Response(null, {
+				status: 303,
+				headers: {
+					location: `${this.#options.mount}/login`,
+					"cache-control": "no-store",
+				},
+			});
+		// A missing session is the normal way to meet a login page, not worth a line each time.
+		const { logger } = this.#options;
+		const fields = { refusal: refusal.refusal };
+		if (refusal.login) logger.debug(fields, "console request refused");
+		else logger.warn(fields, "console request refused");
+		return new Response(refusal.status === 401 ? "Unauthorized" : "Forbidden", {
+			status: refusal.status,
+			headers: { "cache-control": "no-store" },
+		});
 	}
 
 	/** A server-sent event stream that says `changed` whenever the console may differ. */

package/src/http.ts

@@ -9,5 +9,13 @@ export class ConsoleHttpError extends Error {
 		super(message);
 	}
 }
+/** Text safe in element content and in a quoted attribute value. */
+export const escapeHtml = (value: string): string =>
+	value
+		.replaceAll("&", "&")
+		.replaceAll('"', """)
+		.replaceAll("<", "&lt;")
+		.replaceAll(">", "&gt;")
+		.replaceAll("'", "&#39;");
 export const json = (body: unknown, status = 200): Response =>
 	Response.json(body, { status, headers: { "cache-control": "no-store" } });

package/src/index.ts

@@ -35,7 +35,7 @@ export {
 /** Summary for a trusted host's separately stored party sessions. */
 export { conversationFiles as sessionSummary } from "./conversations.ts";
 export type { ConsoleFeatures, ConsolePresentation } from "./features.ts";
-export type { WebConsoleOptions } from "./options.ts";
+export type { WebAuthOptions, WebConsoleOptions } from "./options.ts";
 export { DEFAULT_RELAY_NOTE } from "./options.ts";
 export type { RequestVerifier, Verdict } from "./verifier.ts";
 export { admit, admitAs, refuse } from "./verifier.ts";